Hi,
this is Kevin Henry, and welcome to this course to help you prepare for the
CCSP and to improve your knowledge of cloud security.
This is part of the Certified Cloud Security
Professional examination preparation.
And we're going to start out with the first domain, Cloud Concepts,
Architecture and Design for the CCSP. So let's start by
looking at cloud concepts and architecture.
This entire course is divided into six different areas according to the exam
outline published by (ISC)². This first domain, Cloud Concepts,
Architecture and Design, is worth 17% on the examination.
Cloud Data Security 20%.
Then we'll look at Domain 3, Cloud Platform and Infrastructure
Security 17% and the same for Cloud Application Security.
The areas of Cloud Security Operations is worth 16% and the
final, Legal, Risk and Compliance worth 13%.
This course, Cloud Concepts, Architecture and Design is divided into
three parts. We're first of all going to look at cloud concepts and
architecture before we come back to visit the areas of principles of
secure cloud computing.
And finally, we'll finish this off with the evaluating of cloud
providers. In the area of cloud concepts and architecture, it helps
maybe to take a look at where we've been and certainly, hopefully a
little bit of where we're going.
The whole idea of the cloud is not really new.
It's a marketing term brought out in the 1990s, specifically to give mystery to
this area of storing our data on somebody else's computer.
I know that might be a little bit simplistic, but in reality that's
kind of what we're doing. And that's why this course on cloud
security is so important because we're looking at an area that is
very much beyond our direct control.
It's a relationship quite often between two different parties,
and that means that we need to understand what are the security
implications of that relationship.
But doing remote data hosting is something that many large companies and
governments did all the way back in the 1960s and '70s. Now,
however,
we have greatly evolved and improved that to the area of
things like orchestration and the flexibility and, of
course, now it's open for everybody.
Anybody can use the cloud and most people do. They're backing up their phones,
their pictures, and so on, and using cloud‑based email services.
Where is the future?
Well, it would be always good to know,
but this is a continuously evolving area. And we know that cloud
deployments are most likely going to be an integral part of pretty
much every business going into the future.
So therefore, we should be aware of some of the
security implications concerning this.
If we look at the definition of cloud computing as provided by the
International Organization for Standardization through their various
ISOs, they say that it's a paradigm for enabling network access to a
shared and elastic pool of shareable,
physical, or virtual resources with
self‑provisioning and administration on demand.
So the idea, of course, is that in many cases we've always used
network access to a server in a server room,
which is different from just having storage on our own computer.
But the idea of being a shareable set of resources, both physical and
virtual, provides many benefits as we know with the economies of scale
and the ability to expand and even reduce the amount of equipment that
I'm using and paying for as well.
NIST defines cloud computing as a model for enabling ubiquitous,
convenient, on‑demand network access to a shared pool
of configurable computing resources, for example,
networks, servers, storage,
applications, and services that can be rapidly provisioned and released with
minimal management effort or server provider interaction.
The problem with these definitions is that there are many,
many different deployments of the cloud,
so NIST admits this in their statement.
It is important to understand, however,
that the term cloud computing encompasses a variety of systems and technologies,
as well as service and deployment models and business models.
A number of claims that are sometimes made about cloud computing,
for example,
that it scales or that it converts capital expenses to operational
expenses are only true for some kinds of cloud systems.
So therefore, we see that the term cloud is very generic and
actually refers to many different deployments.
We also see this that each vendor can kind of define
cloud computing in their own way.
So one of the things with this course we're going to try to do is look
at things from a more generic type of perspective,
rather than how any one cloud provider actually provides service.